CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_management_ajax_handler() function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and manipulate several of the plugin's settings and features.
Explanation of Vulnerability in Simple Terms
The Library Management System versions 3.1 and earlier lack proper authorization checks on certain operations. A logged-in user with low privileges can modify data they should not have access to. The vulnerability requires valid authentication but no special user interaction. Integrity of system data is at risk.
What an attacker can do
Modify data or records in the system that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized changes to library records, user data, or system configuration by low-privilege accounts.
Conditions required to exploit
Attacker must have a valid low-privilege user account and network access to the application.
Key dates
External resources
